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Abstract 

This paper addresses the process of performing detailed and thorough fire protection hazard analysis for the 
microgravity environment aboard the International Space Station (ISS). 

Introduction 

The fire aboard the Mir Space Station on February 23, 1997 clearly demonstrates the need for thorough, 
comprehensive fire detection and suppression hazard analysis. Important to the success and usefulness of the 
analysis, however, is the consideration of the “human element”, and the role it plays in the unique environment of 
microgravity. 


NASA has experienced several mishaps, including fire events associated with space flight vehicles, some of which 
had the potential for or resulted in catastrophic consequences. In 1966 the Apollo I crew of Gus Grissom, Ed White, 
& Roger Chaffee died during a training exercise, when a spark ignited nylon netting which generated Carbon 
Monoxide (CO) fumes, asphyxiating the astronauts. In 1986 the Shuttle Challenger exploded less than 2 minutes 
after liftoff due to failure of O-rings that provided a seal between Solid Rocket Booster segments. In February, 

1997, a fire occurred on the Mir space station, fortunately with no injuries thanks to the quick response of the crew. 
Of the three fire events mentioned, the fire aboard Mir is this paper’s focus. In the micro gravity environment of 
Space, unique factors must be considered in the overall fire prevention scheme to ensure the safety of personnel and 
equipment. With the construction of the International Space Station, the need for safe and effective fire protection 
measures is significantly increased. One must learn a great deal about fire fighting, as well as fire protection, from 
previous fire events in microgravity, and the lessons learned and mitigation strategies developed as a result. 

The elements of a successful fire protection scheme in spaceflight application include the following: prevention, 
detection, isolation, annunciation, and suppression (see Figure 1). The first, most important, step in the process to 
achieve a successful fire protection scheme is the hazard analysis. This hazard analysis is conducted early and 
revisited often in the life of a spaceflight project. The hazard analysis addresses key issues such as design of 
components, analysis of electrical interfaces (wire sizing/fusing, color-coding, keying of connectors, use of inhibits, 
etc), selection of non-flammable materials, dedicated software to monitor temperatures and other key parameters, 
the use of smoke and heat detectors, and so on. 
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Figure 1- Fire Protection Scheme 




Typical terrestrial fire detection measures are usually not appropriate in the space environment, because of the 
manner in which smoke and heat are propagated in microgravity. It is important to consider in the design phase the 
implementation of isolation features to prevent flame propagation, and to attempt to eliminate the introduction or 
replenishment of oxygen to “starve” the fire. Because flame characteristics differ in microgravity from those on 
earth, and the distribution of suppressant is adversely affected as well, special planning is required to ensure 
suppressant measures are effective. Should a fire event occur, it is imperative that the event be detected as quickly 
as possible. The microgravity environment requires that special considerations must be given to the detection 
scheme. Means must be provided to ensure that smoke is introduced to the detection device or that operational 
parameters are constantly monitored such that annunciation can be provided in a reasonable and meaningful 
timeframe. The following will discuss several lessons learned from our experience on Mir, and features that have 
been factored into the design and operation of the International Space Station. These can be used to provide fire 
protection guidance to any space flight vehicle. 

In preparing a suitable set of lessons learned for a hazard analysis addressing this scenario of fire or smoke in the 
microgravity environment, the Mir event is particularly useful. 



Mir Space Station 


The Mir event of February 23, 1997 is the most serious fire event in the on-orbit environment ever experienced, and 
its impact was felt on the US Space program. Other events, such as the Challenger disaster, or the Apollo fire on the 
launch pad, occurred on the ground or just after liftoff, that is- under gravity. Much has been written about these 
events, and they have received tremendous scrutiny, design review, evaluation and documented lessons learned. In 
the case of the Apollo disaster, two simple modifications were made that eliminated this potential. In the case of the 
Challenger event lessons learned, extensive pre-flight inspections have been implemented, design reviews 
conducted, and communications among team members have been improved. But as the U.S. embarks on the ISS era 





International Space Station (late 2001) 


a new scenario is introduced, the task of ensuring the safe operation over the long-term on the ISS. A serious fire 
could not only endanger the lives of the crew, but could seriously harm the efforts of several countries, which have 
invested many years and many billions of dollars in this ambitious project. If a segment or particular component is 
damaged by fire, we don’t have the option of returning it to earth for repairs, as with the shuttle. 

So let’s consider the task of performing a comprehensive, and useful hazard analysis for the hazard: “Fire Event 
Onboard the ISS”. We’ll use the Mir fire event as the learning tool. To do this effectively, we need to consider all 
sources of information, to understand what occurred onboard Mir, not just from “official” press releases, but also 
from the transcripts of interviews with the astronauts themselves, and investigative reports. It is important to 
consider the dynamics of the crewmembers that resided on Mir at the time, their training, the degree of teamwork, 
and specifically their broad knowledge of operational systems and safety procedures. The following summary of the 
Mir event illustrates the need for comprehensive training and procedures. 


The MIR crew at the time of the fire mishap of February, 1997, consisted of one American astronaut, Jerry 
Linenger, two Russian cosmonauts from M1R-22, and the M1R-23 team of two Russian cosmonauts and a German 
researcher representing the German Space Agency, DARA. Linenger had launched with the shuttle mission STS-81 
on January 12, 1997, and eventually returned to Earth with STS-84 on May 24, 1997. His 132 days in orbit set the 



record for longest duration flight of any American male up to that point. It is important to note in reviewing the 
response of the crew to this incident, that Linenger was highly trained and experienced. In the course of his stay on- 
board MIR, the fire incident was not the first or only anomaly experienced. Besides the fire, Linenger and his 
Russian crewmates faced several difficulties including: failures of onboard systems (oxygen generators, carbon 
dioxide scrubbing, cooling line loop leaks, communication antenna tracking ability, urine collection and processing 
facility); a near collision with a resupply cargo ship during a manual docking system test; loss of station electrical 
power; and loss of attitude control, resulting in a slow, uncontrolled "tumble" through space. In spite of these 
challenges and the added demands on their time, they still accomplished all the mission's goals, including all of the 
planned U.S. science experiments. Linenger, in particular, received extensive training in Russia prior to his mission. 
He is highly educated, as evidenced by the following excerpt from the shuttle history website: Linenger became an 
astronaut in 1993. He received a Bachelor of Science in bioscience from the United States Naval Academy, a 
Doctorate in Medicine from Wayne State University, a Master of Science in systems management from the 
University of Southern California, a Master of Public Health in health policy from the University of North Carolina, 
and a Doctor of Philosophy in epidemiology from the University of North Carolina. 

Following his first mission, on STS-64 in Sept, 1994, Linenger began training at the Cosmonaut Training Center in 
Star City, Russia, to prepare for the long-duration stay aboard Mir. 



US Astronaut Jerry Linenger Aboard Mir 


All training was conducted using the Russian language, and consisted of learning all the Mir space station systems, 
simulator training, Soyuz launch/return vehicle operations, and spacewalk water tank training. In addition, he was 
the chief scientist for all US science conducted aboard Mir. So, he was intimately familiar with the Mir systems, 
and fluent in Russian. Because there was no language barrier, and the astronauts were familiar with all Mir systems, 
the event was less severe than it could have been. Everyone was trained equally on the function of the Mir systems. 
That is important to understand and factor into future lessons learned. Any crew working together will be better 
equipped to deal with anomalies if all the team is equally qualified on systems and emergency response procedures. 
The authors have worked in industrial settings where only a handful of trained “emergency responders” were tasked 



with the overall emergency response assignments for the entire workplace. This could lead to delays in response 
time, when time is of the essence. That is no more evident than in the Mir fire, where 6 well-trained men found 
themselves in a serious predicament 250 miles above the earth. The following description of events, taken from the 
February 24, 1997 NASA news release, clearly describes the value of extensive crew training: 

“A problem with an oxygen-generating device on the Mir space station last night set off fire alarms and 
caused minor damage to some hardware on the station. No injuries to any of the six crewmembers onboard were 
reported. The fire was located in the Kvant-1 module. The fire, which began at 10:35 p.m. Sunday, Moscow time, 
burned for about 90 seconds. The crew was exposed to heavy smoke for five to seven minutes and donned masks in 
response. After completing physical exams of everyone onboard, U.S. astronaut Jerry Linenger, a physician, 
reported that all crewmembers are in good health. Medical personnel have directed them to wear goggles and masks 
until an analysis of the Mir atmosphere has been completed. Lithium perchlorate candles are burned to generate 
supplemental oxygen when more than three people are onboard the space station. The oxygen- generating candles 
usually burn for five to 20 minutes. Russian officials believe the problem began when a crack in the oxygen 
generator’s shell allowed the contents of the cartridge to leak into the hardware in which it was located. 
Crewmembers extinguished the fire with foam from three fire extinguishers, each containing two liters of a water- 
based liquid. The damage to some of Mir’s hardware resulted from excessive heat rather than from open flame. The 
heat destroyed the hardware in which the device, known as a "candle," was burning, as well as the panel covering 
the device. The crew also reported that the heat melted the outer insulation layers on various cables. It is reported by 
Russian flight controllers that all Mir systems continue to operate normally, however. "It is unfortunate that this 
incident occurred, but we are thankful that there were no injuries,” said Frank Culbertson, Director of the Phase 1 
Shuttle-Mir program. "Russian management and operations specialists have been very informative as to what 
happened, and we are working closely with them on evaluating the health of the crew and how best to respond to the 
damage," added Culbertson. "The crew did a great job handling the fire, and the ground support has been excellent 
on both sides."” 

As a System Safety engineer, reading this account raises a number of “What if’ type questions. For example: 

(1) What if the crew had not noticed the flames right away? (Detection) 

(2) What if critical hardware had been located adjacent to or across from the flames? (Isolation in 
design mitigation & systems integration) 

(3) What if smoke had eliminated visibility/access to fire fighting equipment? (operational 
training) 

(4) What if not all the crew had been trained in response procedures? (operational training, 
supervisory errors) 

(5) What if the annunciation feature had worked improperly or failed to work? (annunciation) 

(6) What if there had been a language barrier between crewmembers? (operational training, 
supervisory errors) 



It is very important to consider all available information that has been published about this event. You may have 
discounted some or all of these “what if’ questions, but this paper relays that there is more to the story than what we 
heard in the excerpt from the press release. Both NOVA Sc CNN conducted thorough investigative reports on the 
history of Mir. The NOVA report is particularly interesting. They interviewed Jerry Linenger about the fire on Mir. 
and he had some interesting insights into the actual events. According to Linenger, the six crewmembers were 
enjoying a “festive evening 5 ’- the Mir-23 crew had recently arrived, and the Mir-22 crew was soon to depart. With 
six onboard, oxygen was being used up more quickly than usual, so a supplemental oxygen canister, or cassette, was 
placed into service. The Supplemental Free Oxygen Generator (SFOG) is used on Mir as a supplemental source of 
oxygen in the event the main source of oxygen, the Elektron, fails or electrical power to run the Elektron is 
unavailable. The SFOG is designed to burn solid fuel cassettes (or candles) of lithium perchlorate. Activation of 
lithium perchlorate creates an exothermic reaction. The reaction from a cassette can supply enough oxygen for one 
person per day. All six astronauts were sitting around a table, when, in Jerry Linenger’ s words, “I looked down a 
passageway, and I could see a very large flame bursting out of the canister, smoke billowing out, and I knew we had 
a problem.” (Detection) A leak had caused a chemical reaction in the oxygen canister and turned it into a giant 
blowtorch. Linenger continues, “Molten metal was flying across splattering on the other side of the bulkhead, which 
meant it was hot. The flame was at least this big- two, three feet directional. It had oxygen, it had fuel. It had 
everything it needed ” (Isolation) Thick black smoke was rapidly filling the module. Note that Mir was 
approximately the size of three school buses hooked together. A Russian cosmonaut, Sascha Lazutkin, made an 
interesting comment here, “When I saw the ship was full of smoke, my natural earthly reaction was to want to open 
a window. And then I was truly afraid for the first time. You're in such a small space that you can’t escape from the 
smoke. You can’t just open a window to ventilate the room.” Linenger comments next; “I grabbed the respirator off 
the wall, activated it, took a breath, and I didn't get any oxygen. At that point, there was a lot of smoke. I took the 
mask off. Again, Earth instinct made me look low to try to find a clear spot where I could get a quick breath because 
I was getting very short of breath at that time. But, it was solid smoke. Smoke does not rise in space like it does on 
the ground. It’s just everywhere. I went to the other respirator on the other wall. Opened it up. At that point, Vassily 
was there. Fie saw I was getting into trouble. He helped me get the thing out. I activated it again. Put it on. Breathed 
in, and luckily got oxygen at that point.” (Training, maintenance) 



Linenger with respirator and “candle” 


Note here that the fire was blocking one of the two Soluyz escape vehicles that were docked to Mir. That meant 
that only three of the six crewmembers would have been able to escape. A second Russian crewmember and 
Linenger commented on the use of the fire extinguishers: “The fixe extinguisher functions in two ways, foam and 
water. When I started spraying foam on the hot canister, it didn't stick and had little effect, so I switched to water 
and started using that. 5 ’ (Design) LINENGER: “We went through two, three fire extinguishers and they really didn’t 
do much to stop anything. But the water did keep the fire from spreading.” After fourteen minutes, the fire burned 
itself out. (Isolation) 

A report written by the NASA Inspector General adds additional information that is worthy of consideration. Here 
is an excerpt of what the NASA internal investigation of the event revealed. Soyuz de-orbit plans were not available 
in hard copy. While the fire was burning, one cosmonaut was at the computer terminal printing out hard copy de- 
orbit plans. American astronaut Dr. Linenger was unable to get oxygen from the first gas mask he attempted to use. 
The next mask found provided sufficient oxygen. At that point, all crewmembers needed gas masks to breath. 
Clamps designed to keep the fire extinguishers in place during initial launch were not removed after Mir was 
operational. During the fire, the crew had to get tools to remove these clamps before they could attempt to 
extinguish the fire. Furthermore, one of the fire extinguishers used did not work properly. When the smoke appeared 
to dissipate and the gas masks ran out of oxygen, there was not capability on board Mir to determine if the air was 
actually safe to breathe. As a safety measure, the crew used surgical type masks for several days. 

It is obvious that to ensure safety of the crew and vital equipment against the threat of fire on the ISS, careful 
consideration must be given to the hazard analysis process. Factoring in real events and the experience of those 
involved is a must. The “standard” checklist of items that we consider has already been mentioned, e.g., design of 
components, analysis of electrical interfaces (wire sizing/fusing, color-coding, keying of connectors, use of inhibits, 
etc), selection of non-flammable materials, dedicated software to monitor temperatures and other key parameters, 
and the use of smoke and heat detectors. These are the most common design mitigations against similar events but 
they are only a menu of options. We must ensure the proper functioning of all emergency response equipment and 
detection/annunciation devices via stringent verification processes. Equipment lifetimes must be taken into account 
when choosing hardware. The exchange of hardware and materials introduces different scenarios to evaluate from a 
FDS perspective. Reconfiguration of ISS hardware, i.e., experiment change out requires re-evaluation of FDS to 
consider new integration hazards. (Implementation) 

We mentioned at the outset the initial considerations always addressed in performing hazard analyses for fire 
detection and suppression purposes. Another obvious key is the implementation of adequate procedures. This is a 
challenge with ISS as multiple partners are involved, and existing agencies have established “ways of doing 
business”. However, agreements have been hammered out, and documents exist that detail the requirements and 
responsibilities of all participants in the ISS. For example, System Specification For The International Space 
Station, #41000F (ref. 1), prepared by Boeing for NASA, contains a section entitled “Respond to Emergency 



Conditions”, and under that “Respond to Fire”, for every segment of the ISS. This levies requirements across the 
board to every partner tasked with the construction of some part of the ISS. This idea of standardizing requirements, 
and having all partners “buy-in” to the safety concept and requirements is a key to ensuring the safety of crew and 
equipment. Each section in ref. 1 contains the following types of requirements that must be met: 

• Time limits for verification of crew-initiated notification of a fire event 

• Performance of hazard analysis using segment hazard analyses data, including assessing the 
loss of safety-critical functions 

• Verification of capability to apply fire suppressant material 

• Analysis to ensure release of suppressant material is compatible with material usage and does 
not create a toxic environment 

• Verification that the suppressant system can be disabled during maintenance to prevent 
inadvertent release 

• Verification of drawings to ensure the right number of PBAs & PFEs are called for 

• Verification of capability to refill suppressant after discharge 

• Analysis to determine if the fixed suppression system can remain operational after isolation of 
a fire event, i.e., can the suppression system remain operational when power is removed from 
a fire event location. 

• Verification of a reliable pressure indication of the on-orbit fixed suppression system 

• Each segment has requirements for response time, isolation time after detection, annunciation 
parameters, ease of access to fire-fighting equipment, and of course prevention measures 

There are many procedures like this at the various organization levels, and they serve to bring the necessary safety 
requirements together to ensure their use throughout the design and implementation phases of the various segments. 

This atmosphere of constant change, as investigations come and go, combined with long-term residency, and long- 
term use of equipment and the structure itself, make for an interesting and unique situation when analyzing the 
hazards of fire detection and suppression. It is clear from the experience on Mir in 1997 that we cannot take 
anything for granted, and ultimately, after the best we can do, the safety of the crew rests largely with the 
crewmembers themselves. We can do the following: ensure the design is safe, the proper materials are selected, 
safety features are provided, both in the form of software and hardware, and the crew are trained. We learned with 
Mir though, that equipment can fail to function, and “earth-instincts” tend to take over. What’s the answer? The 
answer clearly lies in taking a team approach to ensuring the safety of crew and equipment, and having a 
commitment among all parties that safety is the first priority. We must never miss the “human element” in the 
process of performing our hazard analyses. This will ensure that procedures are thorough, and well thought out, that 
design choices are made from the right perspective, materials selections are made with the “big picture” in mind, 
that the crew is provided the means to become thoroughly and adequately trained with safety in mind, and that the 
design and systems integration team places safety at the top of the list from concept to implementation. 


The crew aboard Mir on February 23, 1997 did a remarkable job, and probably did not receive the proper credit due. 
It is our job to see that future crews don’t have to deal with such drastic situations. 
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